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1  Abstract/ Resume 


Under  a  Canadian  Safety  and  Security  Program  (CSSP)  targeted  investigation  (Tl)  project  (CSSP-2012-TI- 
1108),  Defence  Research  and  Development  Canada's  (DRDC)  Centre  for  Security  Science  (CSS)  led  the 
automation  of  the  All  Hazards  Risk  Assessment  (AHRA)  process  and  tools,  including  the  automation  of 
scenario  development  and  capability  assessment.  This  report  discusses  the  design  objectives  and 
approach  that  was  used  for  gathering  requirements  to  support  the  development  of  the  Capability 
Assessment  Management  System  (CAMS).  The  CAMS  web-based  application,  which  was  developed  to 
support  the  AHRA  and  systematize  capability  assessment,  is  described  in  greater  detail  along  with  the 
options  analysis.  Functions  that  enhance  the  utility  of  CAMS  software  are  described.  These  include  the 
ability  to  characterize  scenarios  and  maintain  an  inventory  of  "master  events"  and  scenarios;  the  ability 
to  catalogue  tasks  and  maintain  a  historical  record  of  assessments;  and  the  ability  to  capture  subject 
matter  expert  judgement  and  facilitate  comparison  and  analysis  of  capability  gaps  and  requirements 
across  the  emergency  management  spectrum. 


Dans  le  cadre  d'un  projet  d'enquetes  ciblees  du  Programme  canadien  pour  la  surete  et  la  securite  (PCSS) 
(CSSP-2012-TI-1108),  le  Centre  des  sciences  pour  la  securite  (CSS)  de  Recherche  et  developpement  pour 
la  defense  Canada  (RDDC)  a  dirige  I'automatisation  des  outils  et  du  processus  devaluation  tous  risques, 
y  compris  I'automatisation  de  I'elaboration  des  scenarios  et  de  devaluation  des  capacites.  Le  present 
rapport  traite  de  I'approche  et  des  objectifs  de  conception  qui  ont  ete  utilises  pour  rassembler  les 
exigences  necessaires  a  la  mise  au  point  du  systeme  de  gestion  de  devaluation  des  capacites  (Capability 
Assessment  Management  System  [CAMS]).  L'application  Web  du  systeme  CAMS,  elaboree  pour  appuyer 
devaluation  tous  risques  et  systematiser  devaluation  des  capacites,  est  decrite  en  plus  amples  details 
avec  I'analyse  des  options.  Des  fonctions  qui  ameliorent  I'utilite  du  logiciel  CAMS  y  sont  decrites.  II  s'agit 
notamment  de  la  capacite  a  caracteriser  des  scenarios  et  a  tenir  a  jour  un  inventaire  «  d'evenements 
principaux  »  et  de  scenarios,  de  la  capacite  a  cataloguer  des  taches  et  a  tenir  a  jour  un  historique  des 
evaluations  ainsi  que  de  la  capacite  a  consigner  le  jugement  de  specialistes  et  a  faciliter  la  comparaison 
et  I'analyse  des  ecarts  et  des  exigences  en  matiere  de  capacite  a  I'echelle  du  spectre  de  la  gestion  des 
urgences. 
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4  Report  Details 

4.1  Background 

4.1.1  General 

The  DRDC  CSS  Risk  Assessment  and  Capability  Integration  (RACI)  Section  undertook  a  multi-year,  multi¬ 
faceted  targeted  investigation  (Tl)  project  (CSSP-2012-TI-1108,  ending  in  2014),  aimed  at  further 
exploiting  and  applying  the  All  Hazard  Risk  Assessment  (AHRA)  and  building  on  the  AHRA  framework 
thru  a  multi-year  spiral  development  approach. 

Several  teams  were  formed  to  further  the  implementation  of  the  AHRA  framework.  This  report 
specifically  deals  with  the  functional  requirements  evolving  from  work  stream  2  (Capability  Assessment) 
and  related  automation  design  and  implementation. 

4.1.2  Historical  evolution 

DRDC  CSS  implemented  its  first  automation  tools  to  support  Consolidated  Risk  Assessment  (CRA)  in  the 
mid  2000's.  The  following  figures  (1  and  2)  provide  a  visual  on  CRA  functionality. 


Figure  1  -  PSTP  FSSSMS  CRA  Vignettes  by  Lead  Cluster  and  Threat 
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Figure  2  -  PSTP  FSSMS  CRA  Rating  Page 


In  the  late  2000's,  DRDC  CSS  furthered  the  implementation  of  the  CRA  by  implementing  its  first  Full 
Scale  Scenario  Management  System  (FSSMS)  along  with  supporting  tools  such  as  the  CRA,  Vignette 
Management  System  (VMS)  and  Document  Management  (DM)  all  integrated  in  to  a  suite.1  The 
following  figures  (3  and  4)  provide  a  visual  on  FSSMS  functionality.  Some  of  this  work  is  being  pulled  into 
this  initiative,  where  CSS  demonstrated  a  capability  assessment  was  a  natural  extension  of  the  AHRA 
Framework. 


1  For  additional  information,  consult:  Doug  a  Hales  and  Peter  Race.  Public  Safety  Technical  Program  Planning 
Scenario  Framework  Final  Report;  DRDC  CSS  Contractor  Report  (CR)  CR  2010-10;  Defence  R&D  Canada,  Centre  for 
Security  Science;  December  2010,  http://cradpdf.drdc-rddc.gc.ca/PDFS/uncl03/p534210  Alb. pdf  accessed  17 
January  2014. 
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Figure  3  -  PSTP  FSSMS  Chain  of  Events 
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Figure  4  -  FSSMS  Tool  Kit  Modules 
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In  the  late  2000's  work  began  on  the  AHRA.  The  AHRA  was  developed  by  Public  Safety  (PS)  Canada  in 
close  partnership  with  DRDC  CSS,  and  follows  an  annual  business  cycle  (see  figure  5). 
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Figure  5  -  AHRA  Business  Cycle 


The  AHRA  in  the  end  leveraged  the  expertise  of  DRDC  CSS  as  well  as  knowledge  gained  through  the 
design,  development  and  implementation  of  the  CRA  and  FSSMS.  Simple  tools  were  created  to  assist 
with  documenting  scenario's  (Risk  Event  Scenario  Template  in  word  format)  and  Scoring  Tool  in  MS 
Excel  and  are  currently  in  production. 
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4.2  Design  Objectives 

A  need  was  identified  to  augment  the  established  AHRA  process  to  address  Full  Scale  Scenario's  and 
Capability  Assessment.  Note  the  additions  of  the  Full  Scale  Scenario  and  the  Capability  Assessment 
modules  to  a  more  comprehensive  AHRA  generic  model  below  (figure  6). 


The  original  FSSMS  was  deemed  to  be  technically  correct  however  not  suitable  to  a  general  user 
community  therefore,  simplicity  in  usability  was  a  primary  design  objective  for  the  Capability 
Assessment  Management  System. 

Other  design  objectives  included: 


•  A  SharePoint  /  Web  Based  Approach 

•  Use  of  MS  SQL  as  repository 

•  Ability  to  generate  analytical  reports  and  graphs 

•  Minimal  maintenance  and  development  costs 

•  Ability  to  integrate  with  other  applications  and  data 
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Figure  6  -  Generic  Capability  Investment  Model 


4.3  Approach 

4.3.1  Requirements  Gathering 

Requirements  gathering  followed  two  parrallel  streams.  I  M/IT  related  requirements  and  Functional 
Related  Requirements 

4.3. 1.1  Functional  Requirements 
4.3.1.1.1Capability  Assessment  Framework 

As  part  of  the  AHRA  Transition  targeted  investment  project,  a  pilot  capability  assessment  was  conducted 
to  implement  concepts  we  had  developed/nurtured  over  the  years.  Monitoring  the  development  of  the 
capability  assessment  framework  was  key  to  understanding  requirements  and  opportunities  for 
automation. 

The  approach  taken  by  DRDC  CSS  to  develop  the  framework  including  the  selection  and  development  of 
a  full  scale  scenario  (Pandemic),  the  identification  of  a  master  events  list,  the  identification  of 
capabilities  associated  to  the  master  events  list  buy  DRDC  /  CSS  and  SME's  and  the  identification  of  tasks 
associated  to  the  capabilities. 

DRDC  in  partnership  with  SME's  (PHAC,  Health  Canada  and  others)  conducted  a  table  top  exercise  (TTX) 
to  rate  the  tasks  associated  with  the  capabilities  and  events  along  the  full  spectrum  of  time  defined  in 
the  full  scale  Pandemic  scenario.  Simple  spreadsheets  and  associated  charting  tools.  Pencils  and  pens 
and  scotch  tape  were  used  to  conduct  the  table  top  exercise,  record  the  ratings  and  report  the  results. 

Of  significant  value  in  terms  of  requirements  was  gaining  the  understanding  that  a  simple  spread  sheet 
like  interface  would  gain  highest  acceptance  with  the  user  community  and  that  by  allowing  for  multiple 
user  to  rate  tasks  on  line  enabled  on  line  reporting  of  results  in  real  time  during  an  exercise.  Other 
anticipated  benefits  would  be  the  significant  time  saving  for  the  facilitators  by  ensuring  that  data 
relationships  be  maintained  from  scenario  development,  thru  capability  and  task  development  then  on 
to  rating. 


4. 3. 1.1. 2  Exercise  Perseverance  -  Capability  Assessment  Table  Top  Exercise  After  Action  Report 


The  results  of  the  TTX  were  document  in  the  After  Action  Report  by  co-authors  Peter  Avis,  Doug  Hales 
and  Shaye  Friesen.2  The  following  extracts  confirm  the  overall  acceptability  of  the  Framework: 

1.  The  proof-of-concept  capability  assessment  confirmed  the  requirement,  and  appetitive,  for  a  formal 
process  to  link  risk  assessment  to  investment  planning.  In  the  case  of  national  level  risks,  investment 
priorities  and  planning,  public  and  private,  authorities  are  fragmented  and  programs  and  decision  cycles 
are  rarely  fully  aligned.  A  common  planning  framework  offers  the  opportunity  to  promote  integration  and 
a  common  process  the  opportunity  to  develop  best  practices. 


2  Doug  Hales,  Peter  Avis  and  Shaye  Friesen,  Exercise  Perseverance:  Capability  Assessment  Table  Top  Exercise  After 
Action  Report;  DRDC  CSS  Technical  Report  (TR)  DRDC  CSS  TR  2013-010;  October  2013,  http://cradpdf.drdc- 
rddc.gc.ca/PDFS/uncl29/p538062  Alb. pdf  accessed  17  January  2014. 
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2.  The  capability  assessment  methodology  proposed  was  based  on  experience  to  date.  It  was  generally  well 
accepted  by  the  HP  community,  notably  core  concepts  such  linking  capabilities  to  the  EM  pillars,  adoption 
of  mission/function/task  analysis  and  communal  'ownership'  of  task  inventories.  A  number  of  refinements 
to  the  scoring  schema  were  suggested  and  should  be  trialed. 

Within  the  report,  many  visualization  of  the  data  related  to  the  Pandemic  Scenario  and  Capability 
Assessment  are  included  and  formed  a  significant  input  to  the  required  reports  and  visuals  for  the 
Capability  Assessment  Management  System  (CAMS). 


Of  interest  is  the  visible  mapping  between  the  logic  model  presented  in  the  report  and  the  AHRA  generic 
capability  investment  model.  The  logic  model  (figure  7)  details  the  relationships  further  which  were 
identified  in  the  AHRA  vision  (see  figure  6). 
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Risk 
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Characterizes  threats/hazards 
Considers  likelihood  &  impact 


Captures  assumptions 
Establishes  context  &  event  chronology 
Employs  pre/post  Incident  timeline 
Invokes  capabilities 


Capability  Framework 
Target  Capability  List 
-  Canada  (TCL-C) 


Provides  a  taxonomy  and  capability  inventory 
Describes  capabilities,  tasks,  performance  and 
preparedness  measures 


Identifies  capability  needs  and  gaps 
Attributes  shortfalls  (people, 
process,  technology) 


Investment  Plans 


/  Priority  gap 
'  Functional  c 


I  Considers  programatics 
•'  Allocates  resources 
Aligns/integrates  programs  and  projects 


Figure  7  -  Capability  Framework  Logic  Model 
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Breaking  things  down  in  to  business  processes  the  resulting  visual  is  (figure8): 
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Figure  8  -  ARHA  Business  Process  Break  Down 


From  the  above  and  the  User's  Guide  which  was  prepared  for  the  TTX  the  application  of  the  capability 
framework  was  identified  as  a  multiple  step  process  as  follows  (figure  9): 
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Figure  9  -  Capability  Assessment  Business  Process  Breakdown  to  Steps 


4. 3.1. Invalidation  via  Prototype 

To  validate  the  requirements  a  prototype  Capability  Assessment  Management  System  (CAMS)  was 
created  in  MS  Access  and  all  data  from  the  Pandemic  Scenario  and  TTX  was  imported.  Reports  were 
produced  and  compared  with  the  published  Pandemic  TTX  results  and  validated. 

The  following  is  walk-through  of  the  use  of  the  prototype  CAMS. 
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4.3.1. 1.3.1  Create  Scenario 


1 
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Full  Spectrum  Scenarios 


General  Dimensions  Chain  of  Events 


Scenario  Title: 


Outline: 


DU 


Full-Spectrum  Pandemic  Crisis  Scenario 
{Risk  Descriptor: 

[risk  identification 

Risk  Event  Name/Title: 

-Pandemic 

Date  Risk  Identified: 

•25Januaty2011 

.Applicable  RlskCode(s)  (including  the  category(ies(ofthe  standard  AH  RA  Risk  Taxonomy  affected 
lalicious/Health/Pandemic/Human  Related 


-Non-malic 


{Primary  Department: 

-Health  Canada,  Public  Health  Agency  of  Canada,  Transport  Canada 

Risk  Leader: 

•Health  Portfolio 

Key  Information  Sourcesfor  the  Risk  Event  Scenario  Description: 

-Department  of  Homeland  Security,  National  Planning  Scenarios,  April  2005 

H1N120O9  Pandemic  Analysis: 

•Evaluation  and  Scenarios  for  Post-Pandemic  Planning  Risk  Analytical,  August  2010 
Assumptions: 

'The  pandemic  will  result  from  a  new  sub-type  of  influensaA-likely  originating  outsideCanada. 

•Once  infected  it  takes  1-3  days  to  develop  symptoms. 

'Thetransmissibility  of  the  virus  will  likely  be  high;  peopletvith  influenza  arecontagious  before  they  develop  symptoms  up  to  7  days  afterwards. 

■Asymptomatic  or  minimally  symptomatic  individuals  maystall  be  transmitters. 

•A  pandemic  is  likely  to  arrive  in  Canada  within  3  months  of  an  appearance  elsewhere. 

•If  the  pandemic  has  entered  the  United  States,  it  is  likely  to  appear  in  Canada  within  days. 

•Thefirst'peak’  is  likely  to  occur  with  2  to  4  months  after  the  virus  arrives  in  Canada. 

•Historically  pandemicsspread  in  waves  each  lasting6-8  weeks.  There  are  likely  to  be  2  or3  waves,  again  each  lasting  approximately  8  weeks,  followingthe  initial  outbreak.  The  second  wave 
willoccuri  toa  months  after  thermtialmithreak. 


Figure  10  -  Create  Scenario 

Scenario  creation  in  CAMS  is  accomplished  by  creating  a  new  scenario  then  filling  in  the  title  and  an 
outline  of  the  scenario. 
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4.3. 1.1.3. 2  Create  Events 
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Figure  11  -  Create  Events 

To  create  and  event,  one  selects  the  Event  Group  then  the  point  in  time  then  enter  the  event 
description  and  timings  selecting  red  or  blue  from  the  pull  down  to  identify  the  event  a  malicious  or  not. 
This  replaces  the  Master  Events  List  shown  in  the  TTX  After  Action  Report  (AAR). 
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4. 3. 1.1. 3. 3  Create  Capabilities  and  Tasks 


H  Capabilities  and  Tasks  -  D  X 


Event 

Capability  Group 

Capability 

Task 

People  and  Organization 

nfrastructureand 

fechnologogy 

Policies  and  Process 

nd  Practices 

Notes 

’IB& 

V 

Common 

V 

Assess  risk 

Assess  Risk 

Early  risk  assessment - 
but  non-scientific.  Well- 

ensconced 

committees.  Step  in  the 

Governments  at  all  levels 
improve  governance,  law, 
organization,  and  policy  in 
order  to  be  prepared  for  any 

V 

Common 

V 

Assess  risk 

Balance  Investment  and  allocate  resources 
accordingto  priorities  (across  EM  stages  and 
capabilities) 

Better  allocation  to 
recover  and  prevent 
capabilities. 

There  are  single  deaths 
reported  in  the  US  and 
efficient  human  to  human 
transmission  talcing  place. 

V 

Common 

V 

Assess  Risk 

Conduct  rapid  assessment  •  identify, 
characterize  and  evaluate  (specific)  risks 
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Not  enough  being  done 
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Figure  12  -  Create  Capabilities  and  Tasks 

To  enter  a  capability  first  select  the  reference  Event  to  which  it  is  associated  then  select  a  Capability 
Group  and  enter  a  capability  and  task.  This  replaces  the  Capabilities  and  Task  List  in  the  TTX  After  Action 
Report. 
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4.3.1. 1.3.4  Rate  Tasks 
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Figure  13  -  Rate  Tasks 

To  rate  a  task,  the  user  must  identify  themselves  then  rate  the  selected  task  by  using  the  pull  down 
menu's.  During  the  TTX,  users  used  pencil  and  paper  to  rate  the  tasks. 

4. 3. 1.1. 3. 5  Produce  Reports 

The  following  are  visuals  of  the  automatically  generated  reports  from  the  prototype  CAMS  (figures  14 
and  15). 
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Figure  14  -  Produce  Reports  -  Graph  View 
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Figure  15  -  Produce  Reports-  Dashboard  View 
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5  Conclusion 


This  report  was  conducted  as  part  of  a  larger  targeted  investment  project  in  order  to  document  and 
describe  the  evolution  and  design  objectives  of  the  Capability  Assessment  Management  System  (CAMS). 

The  CAMS  application  contains  may  features  and  functions  that  were  not  in  the  original  version  of  the 
FSSMS.  The  FSSMS  database  architecture  focused  on  deriving  gap  descriptions  from  task  lists,  while  the 
CAMS  links  gaps  to  capability  elements  (PPT:  People  and  Organization;  Policy,  Processes  and  Procedures; 
Infrastructure,  Technologies,  and  Tools)  that  are  related  to  tasks  and  capability  requirements.  This 
results  in  greater  emphasis  being  placed  on  characterizing  the  type  of  capability  gaps  at  the  task  level. 
For  instance,  improving  the  capability  to  "manage  data,  information  networks  and  knowledge"  might 
depend  on  the  specific  emergency  management  pillar  (prepare/mitigate,  prevent,  respond,  recover), 
which  can  change  over  the  course  of  an  event.  There  is  also  the  question  of  which  capabilities,  tasks  and 
elements  might  be  a  concern,  based  on  the  results  of  a  capability  assessment  that  would  help  focus 
attention  on  the  need  for  a  balanced  versus  more  targeted  investment  approach.  This  highlights  the 
importance  of  designing  a  framework  that  allows  for  the  elicitation  of  expert  opinion  from  a  wide  range 
of  SMEs  (management,  operations,  policy,  science  and  technology,  etc.),  reflecting  a  holistic  approach  to 
the  various  stages  of  a  scenario. 

The  development  of  CAMS  provides  a  comprehensive,  unified  and  tailorable  framework  that  takes  into 
account  many  dimensions  of  a  scenario  in  terms  of  mapping  it  along  a  continuum  of  response. 

Structured  analytical  techniques  can  be  used  to  analyze  capability  gaps  across  the  emergency 
management  pillars,  better  determine  the  implications  across  organizations,  and  understand  where  to 
focus  planning,  programs  and  investment  decisions.  Like  FSSMS,  CAMS  uses  the  principle  of  cataloguing, 
where  each  domain  will  have  its  sub-set  of  scenarios.  The  idea  is  that  when  planners  have  assessed  a 
number  of  scenarios  from  various  domains,  they  can  then  start  to  analyse  the  implications  across 
domains,  organizations  and  capabilities. 

The  CAMS  application,  like  all  decision  support  tools,  is  only  effective  as  the  information  to  which  it  was 
programmed  to  prioritize  capability  gaps.  In  this  vein,  while  it  is  becoming  a  mature  solution,  the 
scenarios,  capabilities  and  task  lists  need  to  be  designed  (and  reviewed)  by  SMEs  prior  to  rating.  Clearly, 
it  is  not  a  substitute  for  critical  thinking,  and  should  be  used  with  other  complementary  analytical  tools 
and  techniques.  This  would  be  consistent  international  security  risk  management  principles  and 
guidelines. 
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6  Appendix  A 

6.1. 1.1  IM/IT  related  requirements 
6. 1.1.1. Identification  of  possible  appoaches 


On  startup  of  the  project  to  automate  AHRA  and  Capability  Assessment,  contractors  researched  and 
reviewed  available  technology  options  and  tested  to  confirm  viability  and  applicability. 

Options  Identified  for  CAMS  included: 

•  Use  of  MS  Access 

•  Use  of  SharePoint,  MS  SQL  and  InfoPath 

•  Use  of  ASP. Net  and  MS  SQL  in  a  SharePoint  Window 


With  the  DRDC/CSS  spiral  development  approach  risk  associated  with  development  projects  has  been 
mitigated  with  the  use  of  MS  Access  to  prototype  applications. 

Cost  associated  with  prototyping  in  this  manner  are  controlled  and  well  understood,  business  process 
and  requirements  are  better  defined  as  a  result  of  the  prototyping  and  in  the  end  this  approach 
facilitates  and  removes  significant  risk  and  effort  during  production  development.  Prior  to  production 
development  target  architecture  analysis  can  be  conducted  to  determine  the  best  architecture  to 
implement  an  application. 

Below  is  a  visual  of  the  spiral  process. 
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Figure  16  -  Spiral  Development  Process 
6. 1.1. 1.2  Exploration  of  possible  approaches 


For  production  implementation  of  CAMS,  two  approached  we  considered.  The  fundamental  technical 
design  requirements  included: 

•  Application  Supportability  (Low  overall  cost  of  ownership) 

•  Application  must  handle  multi-level  data  relationships. 

6.1.1. 1.2.1  General 

1.  Advantages  gained  thru  automation  should  include: 

a.  Increased  throughput  or  productivity. 

b.  Improved  quality  or  increased  predictability  of  quality. 

c.  Improved  robustness  (consistency),  of  processes  or  product. 

d.  Increased  consistency  of  output. 

e.  Reduced  direct  human  labor  costs  and  expenses. 

2.  Collaboration  can  be  described  as  follows 

a.  Collaboration  is  working  with  each  other  to  do  a  task. 

b.  It  is  a  recursive  process  where  two  or  more  people  or  organizations  work  together  to 
realize  shared  goals 

c.  Teams  that  work  collaboratively  can  obtain  greater  resources,  recognition  and  reward 
when  facing  competition  for  finite  resources 

3.  Knowledge  Management  is: 

a.  Knowledge  management  (KM)  comprises  a  range  of  strategies  and  practices  used  in  an 
organisation  to  identify,  create,  represent,  distribute,  and  enable  adoption  of  insights 
and  experiences. 

b.  Such  insights  and  experiences  comprise  knowledge,  either  embodied  in  individuals  or 
embedded  in  organisations  as  processes  or  practices 
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4.  Information  Management  is: 

a.  The  collection  and  management  of  information  from  one  or  more  sources  and  the 
distribution  of  that  information  to  one  or  more  audiences. 

b.  Involves  those  who  have  a  stake  in,  or  a  right  to  that  information. 

c.  Organization  of  and  control  over  the  planning,  structure  and  organisation,  controlling, 
processing,  evaluating  and  reporting  of  information  activities. 

6. 1.1. 1.2. 2  Integrated  Architecture 

An  integrated  Architecture  involves  hardware  and  software  assets  working  tightly  coupled  to  support 
end  users  application  needs.  Integration  is  not  "out  of  the  box"  and  usually  requires  the  skill  of 
integration  specialists. 

Making  assets  available  for  re-use  is  a  major  objective  of  an  integrated  architecture.  The  following  assets 
must  be  able  to  work  together  to  deliver  the  need  of  the  AHRA/CAMS  automation  project. 

1.  Technology  Infrastructure 

2.  Access  Controls 

3.  Document  Management 

4.  Knowledge  Management 

5.  Development  Environments 

6.  Standards 

7.  Skill  Sets 

8.  Data  Architecture 

9.  Business  Intelligence 

6. 1.1. 1.2. 3  Target  Infrastructure  Architecture 

1.  The  current  target  infrastructure  is  a  model  Microsoft  infrastructure 

a.  Office  Enterprise  2010 

b.  SharePoint  2010 

c.  Windows  Servers  with  IIS 

d.  MS  SQL 

2.  DRDC  CSS  application  consistency  in  presentation  and  remote  partner  /  user  access 
requirements  support  SharePoint  as  the  required  application  interface. 

6. 1.1. 1.2. 4  Asset  Positioning 

1.  MS  SQL 

a.  Suitable  for  Most  Multi-User  DBMS  Needs 

b.  Is  also  the  SharePoint  back  end  DBMS 

2.  SharePoint 

a.  Workgroup  Focus  (Small  or  Large,  In  House  or  Multi  -  Organizational) 

b.  Workgroup  Multi-User  Simple  Apps 

c.  Simple  Spreadsheet  Like  Lists 

d.  Discussion  boards 
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e.  Workgroup  Calendars 

f.  Work  Flow  Applications 

g.  Centralized  /  Corporate  Document  /  Knowledge  Management  and  Work  Flow 
3.  Info  Path  on  SharePoint 

a.  Use  for  Browser  Based  Forms  Only 

b.  One  Form  Per  Forms  Library 

c.  One  Form  Per  List 

d.  No  Support  for  Document  Libraries 

e.  Keep  Forms  Simple  So  Data  Collected  Can  be  Surfaced  in  Forms  Library  (Fields  in  List 
Equivalent)  and  be  Passed  on  to  Bl  tools 
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6. 1.1. 1.2. 5  InfoPath  -  MS  SQL  Testing  Notes 


1.  Info  Path  for  Complex  App  /  Data  Base  Integration  on  SharePoint 

a.  Use  of  InfoPath  forms  In  Forms  Library,  Not  Suitable  for  Complex  Applications. 

b.  Does  Not  Support  Parent  Child  Implementations  involving  Multiple  SharePoint  List  or 
Library  Browser  based  Forms 

c.  SQL  Connected  Forms 

i.  Require  Significant  Investment 

ii.  Multi-Disciplined  Team  to  Develop  and  Implement  and  Support, 

iii.  Has  an  Increased  Data  Path, 

iv.  Potential  for  Data  Duplication 

v.  Significant  Change  Impact. 

2.  Notes  on  Data  Base  Design  for  InfoPath  Using  MS  SQL  Server  Studio 

a.  Must  keep  it  real  simple  (Data  type  limitations  http://msdn.microsoft.com/en- 
us/library/ff621599(v=office,14).aspx) 

b.  Involves  creating  a  data  base,  creating  tables  and  primary  keys,  fields  and  relationships, 
queries 

c.  Involves  set  up  relative  to  authentication 

d.  Involves  design  relative  to  data  access  controls/roles/security 

e.  Comment  -  SharePoint,  InfoPath  and  SQL  have  more  features  apart  than  when 
integrated.  Goes  to  getting  three  systems  to  agree  on  something  hence  features  which 
may  be  desirable  in  a  specific  environment  are  not  supported  in  the  integrated 
environment 

3.  Notes  on  Info  Path  /  Data  Base  Integration 

a.  Design  and  Deploy  Info  Path  Form 

i.  Involves  creating  a  new  info  path  form  using  the  Web  Service  Template 

ii.  Includes  creating  the  data  connection  to  the  web  service.  Many  data  connection 
may  be  involved 

iii.  Includes  creating  a  data  connection  library  on  the  SharePoint  site 

iv.  Includes  Creating  a  form  library  to  store  the  form  on  the  SharePoint  site 

v.  Includes  converting  InfoPath  data  connection  to  a  data  connection  file  which  is 
stored  on  the  SharePoint  Data  connection  Library 

vi.  Includes  having  the  SharePoint  Farm  Administrator  Approve  the  Form 

b.  Comments 

i.  A  single  Data  Connection  library  can  be  used  to  store  all  the  applications  data 
connections 

ii.  Each  InfoPath  form  requires  its  own  form  library 

iii.  Update  function  implementation  requires  passing  parameters  (not  magic)  and 
process  documentation  is  poor  to  non-existent  on  web 

iv.  Once  connection  file  is  stored  in  data  connection  library  it  is  not  modifiable. 

v.  Testing  and  change  implementation  requires  all  above  steps  (save  for  creation 
of  libraries)  to  be  taken  so  there  is  an  impact  end  to  end  on  the  time  frame  to 
produce  a  form 
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vi.  SharePoint  Site  Admin  privileges  are  required  for  the  developer  SharePoint  farm 
admin  approves  these  forms. 

6. 1.1. 1.2. 6  Change  Request  Scenario  -  Info  Path  -  MS  SQL 


1.  Add  field  to  MS  SQL  table,  Web  Service  and  IP  Form 

a.  Add  field  to  MS  SQL  table  using  SQL  Designer 

b.  Amend  Web  Services  (Record  Locking  Controls  Implemented  in  Web  Services  by 
Developer) 

c.  Re-create  Info  Path  Form  (due  to  data  connection  recreation) 

d.  If  form  data  were  saved  to  form  library  by  users  then  there  would  be  some  conversion 
issues  as  well.  (Likely  these  function  would  have  to  be  disabled) 

e.  Notes:  As  complex  a  procedure  as  creating  all  from  scratch. 


Data  Repository 
Minimum  Features 

Say  3  Data  Tables  and  10 
Look  Up  Tables  for  a 
Single  Form 


Contois  Record  Locking 
and  Update  Competition 

Many  Services  Required 
For  one  Complex  Form 

Say  1  Service  per  Look 
Up  Table  and  1  per  Data 
Table  for  a  Single  Form 


Form  Stored  in  SP 
Forms  Lib 

Can  Expose  Data  to  SP 
List 

Can  Store  Data  In  Form 
Under  User  Control 
User  Could  Be  Working 
on  Old  Data. 


Figure  1 7  -  Info  Path  /  MS  SQL  Integration 
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6. 1.1. 1.2.7  CAMS  (Complex)  Application  Requirements 


1.  Well  Designed  DBMS 

a.  Relationships  via  Foreign  Keys 

b.  Advanced  Field  Types  Flexibility 

c.  Scalability 

2.  Well  Designed  Application 

a.  Tight  Relationship  With  MS  SQL  (Short  Data  Path  Length) 

b.  Web  Based  Deployment 

c.  SharePoint  Integration 

d.  Minimized  Change  Impact 

e.  Optimized  User  Experience 

i.  Master  Slave  Forms 

ii.  Minimal  Paging 

iii.  Record  Edits  "in  Place" 

iv.  Multi  Data  Source  Integration 

v.  Minimum  Screen  Real  Estate  Used 

vi.  Complex  Calculations  and  Controls  Available 

6. 1.1. 1.2. 8  Best  of  Bread  Approach  -  The  Right  Tools  for  the  Right  Job 

The  following  is  the  recommend  Architecture  for  AHRA/CAMS 

1.  Infrastructure 

a.  Windows  Server,  IIS  ,  SharePoint,  MS  SQL,  SharePoint  Client  Object  Model 

2.  Integrated  Application  Deployment  (Development  Environment) 

a.  Visual  Studio  and  SharePoint  Client  Object  Model  for  Complex  Apps 

b.  InfoPath  for  Simple  Browser  Based  Forms  in  Libraries  (not  to  be  used  for  SQL 
integration) 

c.  SharePoint  Project  Sites  /  List  Apps 

3.  AHRA  Scenario  Library 

a.  InfoPath  Form 

b.  Surfaced  Data 

c.  Work  Flow 

d.  Low  Complexity 

4.  ARHA  Scenario  Rating  Forms  Library 

a.  InfoPath  Form 

b.  Surfaced  Data  (SP) 

c.  Work  Flow 

d.  Low  Complexity 

5.  CAMS 

a.  MS  SQL  DBMS 

b.  Visual  Studio  /  SharePoint  Client  Object  Model 
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c.  Medium  Complexity 

d.  Reporting  Via  SQL  Reports 
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7  Appendix  B 

7.1.1  Development  and  Testing 

7. 1.1.1  CAMS  Data  Model 


The  CAMS  data  model  represented  below  shows  that  for  a  Scenario  there  can  be  many  associated 
events  and  for  and  event  there  can  be  many  associated  capabilities  and  tasks  and  for  a  task  there  can  be 
many  associated  ratings.  The  Ratings  table  is  the  child  of  the  Capabilities  and  Tasks  table  which  is  parent 
to  ratings  and  child  to  events.  Similarly  the  Events  table  is  child  to  the  Scenario  table  which  is  parent  to 
the  events  table. 


Figure  18  -  CAMS  Data  Model  Visual 


Scenario  Table 

Format 

Id 

int 

Scenario_Title 

varchar(250) 

General_Outlline 

varchar(MAX) 

[Created  By] 

varchar(250) 

Created 

datetime 

Modified 

datetime 

[Modified  By] 

varchar(250) 

Chain  of  Events  Table 

Format 

Id 

int 

FSSJD 

int 

[Event  Group] 

int 

Time_Line_Start_Position 

int 

Start_Date 

datetime 

End_Date 

datetime 

Event_Description 

varchar(250) 

Duration 

int 

Red_Blue 

varchar(250) 
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Capability  and  Tasks  Table 

Format 

Id 

int 

[Chaim  of  Events  ID] 

int 

[Scenario  ID] 

int 

[Capability  Group] 

int 

[Capability  Group2] 

varchar(250) 

Capability 

varchar(250) 

Tasks 

varchar(250) 

[People  and  Organization] 

varchar(250) 

[Infrastructure  and  Technology  and  Tools] 

varchar(250) 

[Policies  and  Process  and  Practices] 

varchar(250) 

Notes 

varchar(MAX) 

Rating  Table 

Format 

Id 

int 

Task 

int 

[Rating  P  and  0] 

int 

[Rating  1  and  T] 

int 

[Rating  P  and  P  and  P] 

int 

Impact 

int 

Notes 

varchar(MAX) 

[User] 

int 

7. 1.1.2  Application  Developemnt  Tools 

The  application  development  tools  are: 

•  Visual  Studio  2012 

•  Ajax  Tool  Kit 

•  SharePoint  Client  Object  Model  2013 

7. 1.1.3  Application  Interface  Design 

The  application  interface  design  was  developed  with  purpose  of  minimizing  communications  with 
remote  servers  for  data.  For  any  selected  scenario  all  related  data  gets  pre-loaded  to  all  form  or  grid 
views  to  give  the  user  the  fastest  possible  response  time  when  working  with  a  scenario. 

The  interface  incorporates  standard  navigation  buttons  as  well  as  standard  insert,  update,  delete,  select 
and  cancel  hyperlinks  in  the  form  and  grid  views  used. 

The  CAMS  application  is  inserted  in  to  a  SharePoint  Page  on  the  AHRA  site  to  allow  for  common  look  and 
feel  as  well  as  co-location  with  AHRA. 
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7.1. 1.4  User  Access  Controls 


User  access  permissions  are  inherited  from  the  AHRA  SharePoint  user  group.  A  user  may  create  and  edit 
their  own  scenarios  and  may  view  other  scenarios.  The  Scenario  owner  is  the  Scenario  Facilitator. 

Rating  Users  may  create  ratings  for  a  scenario  for  which  they  have  been  given  privilege  to  do  so  by  the 
Scenario  Owner. 
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